From cdd69b66d0d1fa0128ddeb87b4082ae073d45ba8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= Date: Wed, 22 Feb 2023 14:46:02 +0100 Subject: [PATCH] CSP remove unrequired policies --- app/Http/Middleware/SecureHeaders.php | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/app/Http/Middleware/SecureHeaders.php b/app/Http/Middleware/SecureHeaders.php index 7dd74b1..073d8ad 100644 --- a/app/Http/Middleware/SecureHeaders.php +++ b/app/Http/Middleware/SecureHeaders.php @@ -32,7 +32,7 @@ class SecureHeaders { View::share('nonce', $nonce = \uniqid()); // * For VueJS dev tool to execute - $jsDev = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : ''; + $jsDev = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'"; $scheme = config('app.env') === 'local' ? 'http' : 'https'; $reportUri = Route::has('cspReportUri') ? \sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : ''; @@ -68,9 +68,8 @@ class SecureHeaders // ! If you dont use ckeditor use this // "style-src 'self' 'nonce-$nonce';", // phpcs:ignore Generic.Files.LineLength.TooLong - "script-src 'self' {$jsDev} 'nonce-{$nonce}' " . \implode(' ', [ - // '\'strict-dynamic\' https: blob:', - '\'strict-dynamic\' https: blob: \'unsafe-eval\'', + "script-src 'self' {$jsDev} " . \implode(' ', [ + 'https: blob:', 'https://www.googletagmanager.com', 'https://cdnjs.cloudflare.com', "$scheme://www.google-analytics.com",